What is the best defense against JSON hijacking?
Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested:
- If the JSON response contains any confidential/non-public data, only serve the response if the request is authenticated (e.g., comes with cookies that indicate an authenticated session).
- If the JSON data contains anything confidential or non-public, host it at a secret unguessable URL (e.g., a URL containing a 128-bit crypto-quality random number), and only share this secret URL with users/clients authorized to see the data.
while(1);at the start of the JSON response, and have the client strip it off before parsing the JSON.
- Have the client send requests for JSON data as a POST (not a GET), and have the server ignore GET requests for JSON data.
Are these all secure? Are there any reasons to choose one of these over the others? Are there any other defenses I'm missing?